Blog Compliance News and Events Walking the walk: Thoropass’s compliance and audit software is now HITRUST i1 certified! July 17, 2024 Jay Trinckes Thoropass is excited to announce its compliance and audit automation software recently achieved HITRUST Implemented, 1-year (i1) Certification to manage data protection and mitigate cybersecurity threats. HITRUST’s i1 certification validates that Thoropass is operating leading security practices to protect sensitive information by leveraging a set of curated controls to protect against current and emerging threats. The HITRUST i1 Validated Assessment and Certification will help Thoropass address cybersecurity challenges and remain cyber resilient over time while keeping customers’ sensitive data safe and secure. “HITRUST is continually innovating to find new and creative approaches to address information security challenges, Thoropass’s HITRUST i1 Certification is evidence that they are at the forefront of industry best practices for information risk management and cybersecurity. Jeremy Huval Chief Innovation Officer HITRUST Read on to learn more about Thoropass’s journey to HITRUST i1. Walking the walk: Why pursue HITRUST i1 certification? As a HITRUST-approved External Assessor firm, we know the importance of maintaining security and building trust with our customers. Since we ‘walk the walk,’ it was important for us to achieve and obtain the HITRUST i1 certification to demonstrate our commitment to the security of our customers. The External Assessment: Assessing the Assessor Every company pursuing HITRUST certification will need to select a HITRUST approved third-party auditor (or a validated HITRUST External Assessor). But what happens when a validated External Assessor needs to be assessed? For this stage of certification, we turned to CyberCrest Compliance to help us complete our External Assessment and reach the finish line for i1. First, Thoropass conducted an in-depth internal readiness assessment. The information gathered from our self-assessment included a comprehensive mapping of the i1 external controls to the internal Thoropass controls along with relevant documentation. This gave CyberCrest a very strong starting point. That, along with the Thoropass team’s internal subject matter expertise, helped the external assessment go off without a hitch and streamline the overall certification process. Selecting an External Assessor who shared the same experience and knowledge of the HITRUST CSF was critical. Working with another experienced Validated Assessor, like CyberCrest, felt like working with an extension of our team. “The team was very responsive with evidence requests and we were able to complete the assessment in a timely manner without quality issues due to the team’s understanding of both Thoropass internal controls and the HITRUST i1 controls and certification process,” Arti Shala, Compliance Manager for CyberCrest explains.” The Thoropass team was well-versed in the HITRUST certification process and technical control requirements. It was clear that Thoropass came prepared! Arti Shala CyberCrest Compliance Two months to i1: How Thoropass streamlined its HITRUST journey Thoropass started its External Assessment with CyberCrest towards the beginning of April 2024. Evidence collection is a big part of the Assessment process and it took only 2 months (from start to finish) to complete. The journey to HITRUST i1 was extremely smooth for a handful of reasons: Deep internal expertise and experience with the HITRUST CSF The team has been working on HITRUST i1 (along with other attestations/certifications) over the last year. Thoropass has extensive in-house HITRUST expertise to lean on, including Zach Rutz, our HITRUST expert and a Senior Manager of Infosec Assurance. The Thoropass platform We were able to leverage our own proprietary multi-framework capabilities, which use Unified Controls and multi-framework action items to eliminate duplicate work and significantly cut down the time it takes to scale a compliance program. For example, we had already obtained ISO 27001 (information security management system) certification, which brought us about 80% of the way to HITRUST i1 Certification. The smart automation within the Thoropass platform itself creates mappings of Thoropass internal controls, evidence artifacts, policies, and procedures to the HITRUST i1 control requirements by unique ID as well as other information security control frameworks. The Thoropass team used their internal instance of the platform to populate the HITRUST MyCSF audit portal with evidence and assessment comments on every control before we even started the i1 assessment. This made it very easy for our team to determine how Thoropass is addressing each requirement statement and request follow-up evidence as needed. Arti Shala CyberCrest Compliance Centralized communication Since all stakeholders were using the Thoropass platform to centralize communication, we were able to respond to CyberCrest’s evidence requests in a very timely manner, which significantly reduced the assessment timeline. As Arti explains, “The Thoropass team was well prepared to describe their control implementation and quickly provide relevant evidence artifacts and documentation linked in the Thoropass platform.” As an External Assessor, it was a great experience working with an organization that was on top of its own control implementation using automation built into the Thoropass platform. Arti Shala CyberCrest Compliance Leading by example, now and in the future Thoropass is thrilled to add the HITRUST i1 badge to our website and we’d like to send a special thank you to the CyberCrest Compliance team for supporting our external assessment so masterfully. As industry leaders, we will continue to go beyond what’s considered ‘table stakes’ in the world of information security and regulatory compliance. This new achievement truly raises the bar and shows our customers how dedicated we are to protecting their sensitive data. Get Started with HITRUST Your journey to HITRUST certification starts here. The future of health tech is HITRUST! Whether you’re seeking e1, i1 or r2, Thoropass is your most comprehensive solution. Get Started icon-arrow Share this post with your network: Facebook Twitter LinkedIn